Splunk Search

Extracting Account Name:

wkbevill
Engager

Oct 28 20:08:57 XXX.XXX.com Microsoft-Windows-Security-Auditing[4]: EventID: 4663 An attempt was made to access an object. Subject: Security ID: XXX Account Name: John Account Domain: XXX 

 

My question is how do I extract the "Account Name: user" from this? I tried creating a new field extract with the space delimiter but if I selected John above, it wouldn't pull the account name from the rest of the log entries.

Thanks in advance!

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Well, delmited fields extractiona work well with... delimited fields. When you have very strict format of your data (like csv).

If you want to extracts parts of a "sentence", you need regex-based extraction.

You need to look for a repeatable part of event that you can "hook" into to find your needed value. In your case it will probably be the constant string "Account Name:" after which the actual username is provided. So you get (assuming that usernames don't contain spaces and symbols)

Account\sName:\s(?<username>\w+)

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well, delmited fields extractiona work well with... delimited fields. When you have very strict format of your data (like csv).

If you want to extracts parts of a "sentence", you need regex-based extraction.

You need to look for a repeatable part of event that you can "hook" into to find your needed value. In your case it will probably be the constant string "Account Name:" after which the actual username is provided. So you get (assuming that usernames don't contain spaces and symbols)

Account\sName:\s(?<username>\w+)
0 Karma

nmohammed
Builder

Try this - 

 

"Account\sName:\s(?P<account_name>.+)\sAccount Domain"
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...